CVE-2025-27580

HIGH7.5

NIH BRICS (aka Biomedical Research Informatics Computing System) through 14

Published Apr 23, 2025

Modified 10 months ago

Details

NIH BRICS (aka Biomedical Research Informatics Computing System) through 14.0.0-67 generates predictable tokens (that depend on username, time, and the fixed 7Dl9#dj- string) and thus allows unauthenticated users with a Common Access Card (CAC) to escalate privileges and compromise any account, including administrators.

References

WEB

https://brics.cit.nih.gov

WEB

https://bugculture.io/CVE-2025-27580/

WEB

https://github.com/RoseHacks/Vulnerability.Research/blob/main/CVE-2025-27580/README.md

WEB

https://github.com/brics-dev/brics

WEB

https://github.com/brics-dev/brics/blob/26bc6bb627a9a60e6c6a8a8c29735ae98c2e2679/core/src/main/java/gov/nih/tbi/CoreConstants.java#L38

WEB